Loading story…
NSFOCUS published research on the security implications of agent “SKILL/Skills” architectures used to package and orchestrate LLM capabilities (reasoning logic, tool calls, and execution flows) into reusable units. The write-up frames Skills as a growing ecosystem (claimed to exceed 100,000 units) that creates a new security boundary for authority management and execution control, and it highlights risk introduced by meta-tool-driven, on-demand prompt injection mechanisms used to load capabilities with low persistent context overhead. The paper positions the attack surface across architecture design, practical attack paths, and ecosystem-level exposure as Skills proliferate into AI IDEs and automated workflow scenarios.
A separate Gopher Security blog post discusses prompt-injection threats in Model Context Protocol (MCP) streams, arguing that encrypted orchestration channels can still be manipulated via indirect prompt injection (e.g., poisoning files/records the model consumes) and that defenders need behavioral/anomaly detection rather than relying on network trust boundaries. It also layers in speculative “quantum” framing (e.g., harvest now, decrypt later and future RSA/ECC risk) to motivate deeper inspection of MCP traffic without breaking privacy; while thematically adjacent (agent orchestration and prompt injection), it is not the same specific SKILL/Skills-architecture research described by NSFOCUS.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
NSFOCUS recommended sourcing Skills only from trusted or official repositories, sandboxing agent execution environments, and conducting pre-deployment security reviews including static analysis, dynamic or semantic analysis, and dependency auditing. The guidance was aimed at reducing the risk of compromised or unsafe Skills being loaded by agents.
NSFOCUS Tianyuan Lab reported surveying roughly 700 open-source Skills from a broader ecosystem of more than 100,000 projects and found no in-the-wild poisoning cases in its sample. However, the lab identified multiple traditional security issues, with code-execution risks described as the most prevalent.
The research presented two practical cases: one in which malicious code embedded in a Skill script could trigger arbitrary command execution, and another in which a skill-creation workflow used Python eval in a way that enabled payload-based code execution despite superficial filtering. These examples showed how both malicious Skills and insecure Skill-generation tooling can lead to execution compromise.
NSFOCUS published research describing the security risks in LLM agent Skill architectures, highlighting supply-chain compromise and resource-poisoning threats arising from instruction files, scripts, and on-demand assets. The analysis emphasized that Skills create a new security boundary because agents may load poisoned prompts or execute compromised local code.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
nsfocusglobal.com
Open sourcensfocusglobal.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers are warning that *AI agent “Skills”* (markdown/YAML instruction packages that extend agent capabilities) are becoming a **supply-chain risk** due to hidden prompt-injection content that can survive human review. A demonstrated technique uses **invisible Unicode Tag codepoints** embedded in skill files to smuggle instructions that some models interpret as executable guidance, enabling outcomes such as **data exfiltration**, prompt injection, and other malicious behavior when the skill is invoked; a basic scanner was also built to help detect these hidden-instruction patterns. Separate reporting highlighted broader evidence of the same threat pattern across agent ecosystems: Simula Research Laboratory identified **hidden prompt-injection attacks** in a measurable portion of sampled content on a platform referenced as Moltbook, and Cisco researchers documented a malicious agent skill (“**What Would Elon Do?**”) that **exfiltrated data to external servers** while being artificially boosted to appear as a top-ranked skill. Researchers also anticipate the emergence of **self-replicating adversarial prompts** (“prompt worms/viruses”) that could propagate through networks of communicating AI agents, amplifying the impact of compromised skills and poisoned instruction content.
Jun 29, 2026
Security researchers and commentators warned that attacks on **LLM-based systems** are evolving beyond simple “prompt injection” into a broader execution mechanism dubbed **promptware**, with a proposed seven-step **promptware kill chain** to describe how malicious instructions enter and propagate through AI-enabled applications. The core risk highlighted is architectural: LLMs treat system instructions, user input, and retrieved content as a single token stream, enabling **indirect prompt injection** where hostile instructions are embedded in external data sources (web pages, emails, shared documents) that an LLM ingests at inference time; the attack surface expands further as models become **multimodal**, allowing instructions to be hidden in images or audio. Related academic work demonstrated a concrete multimodal variant against **embodied AI** using large vision-language models: **CHAI (Command Hijacking Against Embodied AI)**, which embeds deceptive natural-language instructions into visual inputs (e.g., road signs) to influence agent behavior in scenarios including drone emergency landing, autonomous driving, and object tracking, reportedly outperforming prior attacks in evaluations. Separately, reporting on a viral “AI caricature” social-media trend framed the risk as downstream **social engineering** and potential **LLM account takeover** leading to exposure of prompt histories and employer-sensitive data; while largely hypothetical, it underscores how widespread consumer LLM use and public oversharing can increase the likelihood and impact of prompt-driven compromise paths.
Jun 29, 2026
Security researchers and industry reporting describe **prompt injection—especially web-based indirect prompt injection (IDPI)**—as an increasingly practical technique for compromising or manipulating **LLM-powered agents** embedded in browsers and automated content pipelines. Palo Alto Networks Unit 42 reported in-the-wild IDPI activity where malicious instructions are hidden in web content that an agent later ingests, with observed objectives including **AI-based ad review evasion** and **SEO manipulation** that promotes phishing infrastructure. Separately, Zenity Labs detailed a now-patched issue in Perplexity’s *Comet* AI browser where attackers could embed instructions in a **calendar invite** to coerce the agent into accessing `file://` resources and potentially pivoting into sensitive data such as an unlocked **1Password** extension vault, illustrating how agentic tooling can bypass traditional browser-origin assumptions. Threat reporting also shows adversaries operationalizing AI to scale exploitation. Team Cymru linked an AI-assisted Fortinet FortiGate targeting campaign (previously reported by Amazon Threat Intelligence as compromising **600+ devices across 55 countries** using services like **Claude** and **DeepSeek**) to use of **CyberStrikeAI**, an open-source Go-based platform that integrates 100+ security tools and was observed from multiple IPs (primarily hosted in China/Singapore/Hong Kong, with additional infrastructure elsewhere). Multiple commentaries and briefings emphasize that conventional “filter the prompt” defenses are insufficient because LLMs lack a native separation between instructions and data; they call for **defense-in-depth** around AI pipelines, including least-privilege agent permissions, auditable tool use, and stronger identity/workload controls as agent deployments multiply. Several items in the set are unrelated (geopolitical cyber activity, workforce/culture pieces, jobs, and product/market commentary) and do not materially inform the prompt-injection/agent-abuse story.
Sep 3, 2026